Weakness (CWE)
CWE-359: Exposure of Private Personal Information to an Unauthorized Actor
The product does not properly prevent a person's private, personal information from being accessed by actors who either (1) are not explicitly authorized to access the information or (2) do not have the implicit consent of the person about whom the information is collected.
How to prevent it (3 mitigations)
-
Requirements
Identify and consult all relevant regulations for personal privacy. An organization may be required to comply with certain federal and state regulations, depending on its location, the type of business it conducts, and the nature of any private data it handles. Regulations may include Safe Harbor Privacy Framework [REF-340], Gramm-Leach Bliley Act (GLBA) [REF-341], Health Insurance Portability and Accountability Act (HIPAA) [REF-342], General Data Protection Regulation (GDPR) [REF-1047], California Consumer Privacy Act (CCPA) [REF-1048], and others.
-
Architecture and Design
Carefully evaluate how secure design may interfere with privacy, and vice versa. Security and privacy concerns often seem to compete with each other. From a security perspective, all important operations should be recorded so that any anomalous activity can later be identified. However, when private data is involved, this practice can in fact create risk. Although there are many ways in which private data can be handled unsafely, a common risk stems from misplaced trust. Programmers often trust the operating environment in which a program runs, and therefore believe that it is acceptable store private information on the file system, in the registry, or in other locally-controlled resources. However, even if access to certain resources is restricted, this does not guarantee that the individuals who do have access can be trusted.
-
Implementation, Operation
Some tools can automatically analyze
documents to redact, strip, or "sanitize" private
information, although some human review might be
necessary. Tools may vary in terms of which document
formats can be processed.When calling an external program to automatically
generate or convert documents, invoke the program with
any available options that avoid generating sensitive
metadata. Some formats have well-defined fields that
could contain private data, such as Exchangeable image
file format (Exif), which can contain potentially
sensitive metadata such as geolocation, date, and time
[REF-1515] [REF-1516].
Source: MITRE CWE-359
123 results · Clear filters · Feed
-
Medium 4.2
IBM Jazz Foundation information disclosure
IBM Jazz Foundation 7.0.2, 7.0.3, and 7.1.0 could could allow a physical user to obtain sensitive information due to not masking passwords during entry.
-
Medium 5.3
Bypass of Discourse Connect using other login paths if enabled in Discourse
Discourse is an open source platform for community discussion. Sites that are using discourse connect but still have local logins enabled could allow attackers to bypass discourse connect to create accounts and login. This problem is patched in the latest ver…
-
Medium 5.3
WP Job Portal <= 2.2.2 - Missing Authorization to Unauthenticated Arbitrary Resume Download
The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the getResumeFileDownloadById() function in all versions up to, and inclu…
-
Medium 6.5
Ruijie Reyee OS Exposure of Private Personal Information to an Unauthorized Actor
Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a a feature that could enable sub accounts or attackers to view and exfiltrate sensitive information from all cloud accounts registered to Ruijie's services
-
Medium 5.4
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
-
Medium 5.7
Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Files (Window…
-
Medium 5.3
Data leak of notification filters of users in XWiki Platform
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It's possible to get access to notification filters of any user by using a URL such as `<hostname>xwiki/bin/get/XWiki/Notifications/Code/NotificationFilte…
-
Medium 5.3
Exposure of Private Personal Information to an Unauthorized Actor vulnerability on CIRCUTOR Q-SMT
An attacker with no knowledge of the current users in the web application, could build a dictionary of potential users and check the server responses as it indicates whether or not the user is present in CIRCUTOR Q-SMT in its firmware version 1.0.4.
-
Medium 5.3CVE-2024-45591 Scanner template
XWiki Platform document history including authors of any page exposed to unauthorized actors
XWiki Platform is a generic wiki platform. The REST API exposes the history of any page in XWiki of which the attacker knows the name. The exposed information includes for each modification of the page the time of the modification, the version number, the aut…
-
Medium 4.3
Information Disclosure vulnerability in the SAP Business Warehouse (BEx Analyzer)
Due to missing authorization checks, SAP Business Warehouse (BEx Analyzer) allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limit…
-
Medium 4.3
Information Disclosure vulnerability in the SAP NetWeaver BW (BEx Analyzer)
Due to missing authorization checks, SAP BEx Analyzer allows an authenticated attacker to access information over the network which is otherwise restricted. On successful exploitation the attacker can enumerate information causing a limited impact on confiden…
-
Medium 6.8
Dell Path to PowerProtect, versions 1.1, 1.2, contains an Exposure of Private Personal Information to an Unauthorized A…
-
Medium 4.3
Improper access control in the clipboard synchronization feature
Improper access control in the clipboard synchronization feature in TeamViewer Full Client prior version 15.57 and TeamViewer Meeting prior version 15.55.3 can lead to unintentional sharing of the clipboard with the current presenter of a meeting.
-
Medium 5.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in macOS Monter…
-
Medium 5.3
A privacy issue was addressed with improved private data redaction for log entries. This issue is fixed in iOS 16.7.9 a…
-
Medium 5.9
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
-
Medium 5.9
A vulnerability has been identified in SIMATIC PCS 7 V9.1 (All versions < V9.1 SP2 UC05), SIMATIC WinCC Runtime Profess…
-
Medium 6.5
This issue was addressed with improvements to the noise injection algorithm. This issue is fixed in Safari 17.5, iOS 17…
-
Medium 4.3
If the `browser.privatebrowsing.autostart` preference is enabled, IndexedDB files were not properly deleted when the wi…
-
Medium 6.5
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
-
Medium 5.4
Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability
Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability
-
Medium 6.5
Beaver Themer <= 1.4.9 - Authenticated (Contributor+) Sensitive Information Exposure via shortcode
The Beaver Themer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.9 via the 'wpbb' shortcode. This makes it possible for authenticated attackers, with contributor access and above, to extract sens…
-
Medium 4.2
Saleor vulnerable to customers addresses leak when using Warehouse as a `Pickup: Local stock only` delivery method
Saleor is an e-commerce platform that serves high-volume companies. When using `Pickup: Local stock only` click-and-collect as a delivery method in specific conditions the customer could overwrite the warehouse address with its own, which exposes its address …
-
Medium 5.3
Author Box, Guest Author and Co-Authors for Your Posts – Molongui <= 4.7.4 - Information Exposure via ma_debug
The Author Box, Guest Author and Co-Authors for Your Posts – Molongui plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.7.4 via the 'ma_debu' parameter. This makes it possible for unauthenticated atta…
-
Medium 4.3
Contact Form 7 – Dynamic Text Extension <= 4.1.0 - Insecure Direct Object Reference
The Contact Form 7 – Dynamic Text Extension plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.1.0 via the CF7_get_custom_field and CF7_get_current_user shortcodes due to missing validation on a user…
-
Medium 6.8
AsyncSSH Rogue Session Attack
An issue in AsyncSSH before 2.14.1 allows attackers to control the remote end of an SSH client session via packet injection/removal and shell emulation, aka a "Rogue Session Attack."
-
Medium 6.5
Exposure of hashed user passwords via REST API in Nautobot
Nautobot is a Network Automation Platform built as a web application atop the Django Python framework with a PostgreSQL or MySQL database. In Nautobot 2.0.x, certain REST API endpoints, in combination with the `?depth=<N>` query parameter, can expose hashed u…
-
Medium 5.7
Sensitive information disclosure due to spell-jacking. The following products are affected: Acronis Cyber Protect 15 (L…
-
Medium 6.5
A post-authentication information exposure vulnerability in the CGI program of Zyxel ATP series firmware versions 4.32 …
-
Medium 5.3
Discourse tags with no visibility are leaking into og:article:tag
Discourse is an open source platform for community discussion. Tags that are normally private are showing in metadata. This affects any site running the `tests-passed` or `beta` branches >= 3.1.0.beta2. The issue is patched in the latest `beta` and `tests-pas…
-
Medium 4.8
Nextcloud Talk guests can continue to receive video streams from call after being removed from a conversation
Nextcould Talk android is a video and audio conferencing app for Nextcloud. Prior to versions 12.2.8, 13.0.10, 14.0.6, and 15.0.0, guests can continue to receive video streams from a call after being removed from a conversation. An attacker would be able to s…
-
Medium 5.3
Exposure of Private Personal Information to an Unauthorized Actor in xwiki-platform-rest-server
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The `modifications` rest endpoint does not filter out entries according to the user's rights. Therefore, information hidden from unauthorized users are ex…
-
Medium 6.5
A vulnerability in the web-based management interface of Cisco Email Security Appliance (ESA), Cisco Secure Email and W…
-
Medium 5.3
In affected versions of Octopus Server it was identified that when a sensitive value is a substring of another value, s…
-
Medium 4.9
JFrog Artifactory prior to version 7.31.10 and 6.23.38 is vulnerable to Sensitive Data Exposure through the Project Adm…
-
Medium 5.3
Unauthenticated user can list hidden document from multiple velocity templates
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents by rendering some velocity documents. The problem has been patched in XW…
-
Medium 5.3CVE-2022-24819 Scanner template
Unauthenticated user can retrieve the list of users through uorgsuggest.vm
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A guest user without the right to view pages of the wiki can still list documents related to users of the wiki. The problem has been patched in XWiki vers…
-
Medium 6.1
Emuse - eServices / eNvoice Exposure Of Private Personal Information
Emuse - eServices / eNvoice Exposure Of Private Personal Information due to lack of identification mechanisms and predictable IDs an attacker can scrape all the files on the service.
-
Medium 5.3
Exposure of Private Personal Information to an Unauthorized Actor in elgg/elgg
elgg is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
-
Medium 5.3
Adobe Acrobat Reader privacy violation vulnerability could lead to privilege escalation
Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by an Information Exposure vulnerability. An unauthenticated attacker could leverage this vulnerability to get access …